Exam Bundle

A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied. That result is evidence for another corrective change: Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. The alternative problem is: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The current Riverton Utilities issue is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. Its decisive acceptance evidence would be: An approved private client connects using the intended private address and an unapproved external connection fails.

The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy. That result is evidence for another corrective change: Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. The alternative problem is: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The current Riverton Utilities issue is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. Its decisive acceptance evidence would be: An approved private client connects using the intended private address and an unapproved external connection fails.

DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing. That result is evidence for another corrective change: Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. The alternative problem is: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The current Riverton Utilities issue is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. Its decisive acceptance evidence would be: An approved private client connects using the intended private address and an unapproved external connection fails.

Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. That relates to a separate SQL administration problem: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The Riverton Utilities requirement is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. That approach does not directly establish the required fix; the requested acceptance evidence is: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. That relates to a separate SQL administration problem: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The Riverton Utilities requirement is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. That approach does not directly establish the required fix; the requested acceptance evidence is: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. That relates to a separate SQL administration problem: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The Riverton Utilities requirement is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. That approach does not directly establish the required fix; the requested acceptance evidence is: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route. That result is evidence for another corrective change: Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. The alternative problem is: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The current Riverton Utilities issue is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. Its decisive acceptance evidence would be: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing. That result is evidence for another corrective change: Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. The alternative problem is: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The current Riverton Utilities issue is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. Its decisive acceptance evidence would be: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied. That result is evidence for another corrective change: Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. The alternative problem is: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The current Riverton Utilities issue is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. Its decisive acceptance evidence would be: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. That relates to a separate SQL administration problem: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The Granite SaaS requirement is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. That approach does not directly establish the required fix; the requested acceptance evidence is: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. That relates to a separate SQL administration problem: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The Granite SaaS requirement is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. That approach does not directly establish the required fix; the requested acceptance evidence is: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. That relates to a separate SQL administration problem: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The Granite SaaS requirement is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. That approach does not directly establish the required fix; the requested acceptance evidence is: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

An approved private client connects using the intended private address and an unapproved external connection fails. That result is evidence for another corrective change: Configure a private endpoint and private DNS with appropriate network rules and disable unnecessary public network access. The alternative problem is: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. The current Granite SaaS issue is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. Its decisive acceptance evidence would be: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values. That result is evidence for another corrective change: Use a suitably governed column or application encryption design with key management and limited decrypt permissions. The alternative problem is: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The current Granite SaaS issue is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. Its decisive acceptance evidence would be: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors. That result is evidence for another corrective change: Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. The alternative problem is: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The current Granite SaaS issue is instead: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. Its decisive acceptance evidence would be: The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy.

Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. That relates to a separate SQL administration problem: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The Granite SaaS requirement is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. That approach does not directly establish the required fix; the requested acceptance evidence is: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

Move encryption key material to a supported external key store and apply controlled identity access and rotation procedures. That relates to a separate SQL administration problem: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. The Granite SaaS requirement is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. That approach does not directly establish the required fix; the requested acceptance evidence is: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. That relates to a separate SQL administration problem: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The Granite SaaS requirement is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. That approach does not directly establish the required fix; the requested acceptance evidence is: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext. That result is evidence for another corrective change: Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. The alternative problem is: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The current Granite SaaS issue is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. Its decisive acceptance evidence would be: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing. That result is evidence for another corrective change: Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. The alternative problem is: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The current Granite SaaS issue is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. Its decisive acceptance evidence would be: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route. That result is evidence for another corrective change: Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. The alternative problem is: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The current Granite SaaS issue is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. Its decisive acceptance evidence would be: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. That relates to a separate SQL administration problem: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The Oakridge Public Services requirement is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. That approach does not directly establish the required fix; the requested acceptance evidence is: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. That relates to a separate SQL administration problem: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The Oakridge Public Services requirement is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. That approach does not directly establish the required fix; the requested acceptance evidence is: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. That relates to a separate SQL administration problem: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The Oakridge Public Services requirement is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. That approach does not directly establish the required fix; the requested acceptance evidence is: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors. That result is evidence for another corrective change: Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. The alternative problem is: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The current Oakridge Public Services issue is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. Its decisive acceptance evidence would be: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure. That result is evidence for another corrective change: Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. The alternative problem is: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The current Oakridge Public Services issue is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. Its decisive acceptance evidence would be: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session. That result is evidence for another corrective change: Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. The alternative problem is: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The current Oakridge Public Services issue is instead: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. Its decisive acceptance evidence would be: A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied.

Evaluate Always Encrypted with secure enclaves and the required hardware, driver and database feature support for the intended computations. That relates to a separate SQL administration problem: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. The Oakridge Public Services requirement is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. That approach does not directly establish the required fix; the requested acceptance evidence is: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. That relates to a separate SQL administration problem: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The Oakridge Public Services requirement is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. That approach does not directly establish the required fix; the requested acceptance evidence is: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. That relates to a separate SQL administration problem: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The Oakridge Public Services requirement is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. That approach does not directly establish the required fix; the requested acceptance evidence is: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access. That result is evidence for another corrective change: Evaluate Always Encrypted with secure enclaves and the required hardware, driver and database feature support for the intended computations. The alternative problem is: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. The current Oakridge Public Services issue is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. Its decisive acceptance evidence would be: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy. That result is evidence for another corrective change: Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. The alternative problem is: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The current Oakridge Public Services issue is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. Its decisive acceptance evidence would be: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext. That result is evidence for another corrective change: Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. The alternative problem is: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The current Oakridge Public Services issue is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. Its decisive acceptance evidence would be: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.